CVE-2026-6104
criticalPriorität · verfolgen · 36EPSS 0.005 · 40. PerzentilDEEURUUSEPSS · bewertet 2026-10-27
In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–critical · 1.7–9.1
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (37)
Betroffene Produkte und Versionsbereiche.
Advisories (5)
Hersteller- und Ökosystem-Meldungen dazu.
- WID-SEC-W-2026-1433PHP: Mehrere SchwachstellenDeutsch2026-05-07csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in PHP ausnutzen, um beliebigen Programmcode auszuführen, SQL-Injection- oder Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.
- WID-SEC-W-2026-2455Oracle Solaris Drittanbieterkomponenten: Mehrere SchwachstellenDeutsch2026-07-21csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in verschiedenen Komponenten von Drittanbietern in Oracle Solaris ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
- BIT-libphp-2026-6104Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding2026-05-12vendor · osvUS
In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.
- BIT-php-2026-6104Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding2026-05-12vendor · osvUS
In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.
- BIT-php-min-2026-6104Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding2026-05-12vendor · osvUS
In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.
auch bekannt als (6)
Weitere Namen und Kennungen dieser Entität.
- CNNVD-202605-2017cnnvd
- EUVD-2026-28979enisa_euvd
- BDU:2026-13295fstec_bdu
- BIT-libphp-2026-6104osv
- BIT-php-2026-6104osv
- BIT-php-min-2026-6104osv
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (8)
Externe Belege — Patches, Meldungen, Analysen.
- https://nvd.nist.gov/vuln/detail/CVE-2026-6104cnnvd
- https://www.php.net/Patchcnnvd
- https://github.com/php/php-src/security/advisories/GHSA-74r9-qxhc-fx53enisa_euvd
- https://access.redhat.com/errata/RHSA-2026:22649nvd
- https://access.redhat.com/security/cve/CVE-2026-6104nvd
- https://bugzilla.redhat.com/show_bug.cgi?id=2468573nvd
- https://github.com/php/php-src/security/advisories/GHSA-74r9-qxhc-fx53Vendor Advisorynvd
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6104.jsonnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan